Published Jul 26, 2009 | Updated Sep 15, 2017


Detected with Windows Defender Antivirus

Aliases: Trojan-Downloader.Win32.BHO.ocr (Kaspersky) Gen:Trojan.Heur.FakeAV.B0D02F1F1F (BitDefender) Win32/Delf.OOH (ESET) FakeAlert-EL (McAfee)


Trojan:Win32/Liften is a trojan that is used to stop affected users from downloading security updates. It is downloaded by Trojan:Win32/FakeXPA - a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  
Use Microsoft Windows Defender, the Microsoft Safety Scanner (, or another up-to-date scanning and removal tool to detect and remove these threats and other unwanted software from your computer. For more information on Microsoft security products, see
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as the Microsoft Safety Scanner ( For more information, see
Follow us